Telegram’s dark side: a platform exploited by cybercrime

“Offering fake accounts, guaranteed money withdrawal, and biometric money transfers,” read an advertisement in a group dedicated to buying and selling bank accounts seen among Vietnamese Telegram users.

The advertisement appeared after the biometric authentication requirement for money transfers came into effect in Vietnam on July 1.

This group has been active since 2023, attracting over 4,000 members and specializes in services such as creating accounts on demand and producing fake documents. While the authenticity of those advertisements has yet to be verified, the existence of the group and its participants is just one example of how Telegram has become a virtual world where cybercriminals can easily operate openly.

In the past, the typical environment for cybercriminals was the dark web, the parts of the internet that are encrypted (using secret codes), not accessible through standard search engines. This method helped them hide their identities and personal information, making it difficult for authorities to track them while also limiting access to the general public.

However, in recent years, Telegram has emerged as a new version of the dark web, with criminal activities openly taking place on the platform.

Founded by French-Russian billionaire Pavel Durov, Telegram allows anyone to access it simply by downloading the app from the App Store, Play Store, or even using a regular web browser.

A report by cybersecurity firm Kaspersky in July stated that cybercriminals are increasingly using Telegram as a platform for underground market activities.

Cybercriminals actively operate channels and groups on Telegram dedicated to discussing fraud schemes, distributing leaked databases, and trading various criminal services, such as cashing out, forging documents, DDoS attacks as a service and more, it said.

According to Kaspersky’s Digital Footprint Intelligence data, the volume of such posts surged by 53% in May-June 2024 compared to the same period last year.

“The growing interest in Telegram from the cybercriminal community is driven by several key factors. Firstly, this messenger is very popular in general – its audience has reached 900 million monthly users. Secondly, it is marketed as the most secure and independent messenger that does not collect any user data, giving threat actors a sense of security and impunity,” said Alexey Bannikov, analyst at Kaspersky Digital Footprint Intelligence.

Moreover, finding or creating a community on Telegram is relatively easy, which, combined with other factors, allows various channels, including cybercriminal ones, to gather an audience quickly, Bannikov added.

On July 23, Durov announced that Telegram had reached 950 million users, an increase of 50 million in just three months, nearly doubling from 500 million in early 2021. This number makes Telegram one of the most popular platforms in the world.

Durov has repeatedly emphasized that Telegram does not collect user data and rarely cooperates with governments.

Using tools like group chats and channels, criminals can easily create communities to exchange illegal information. These groups can hold up to 200,000 members and can be easily found through the platform’s search tool.

“Telegram can be easily found in the App Store. And if someone can imagine something they want, Telegram almost certainly has it,” reads a Fortune report.

According to a report published in February by DataReportal, an online platform that provides comprehensive reports and insights on global digital trends, including social media usage, internet penetration, mobile usage, and e-commerce, there were 78.44 million internet users in Vietnam at the start of 2024, and around one-third of them use Telegram.

Ngo Minh Hieu, a former hacker who was convicted in the U.S. and has returned to Vietnam to work as a cyber security specialist, said scammers typically approach victims through social media posts on platforms like Facebook, then contact them via Telegram.

He said that all chat apps can be used for such activities, but criminals choose Telegram due to its anonymity and message self-destruct feature.

On Facebook Messenger, fake accounts can be identified through their Facebook profiles, but Telegram requires nothing more than a phone number for OTP verification, which can easily be rented or purchased through bulk services.

Telegram could soon reach 1 billion users this year and aim for 1.5 billion by 2030, as Durov envisioned. To maintain its independence, he was seeking additional funds through bond investments, planning an IPO, and selling ads.

Telegram chief executive Pavel Durov. Photo by AFP

In a statement posted on its platform after the arrest, Telegram said it abides by EU laws including the digital services act, and its moderation is “within industry standards and constantly improving”.

Durov, the company added, “has nothing to hide and travels frequently in Europe”.

“It is absurd to claim that a platform or its owner are responsible for abuse of that platform,” Telegram’s post said. “Almost a billion users globally use Telegram as means of communication and as a source of vital information. We’re awaiting a prompt resolution of this situation.”

According to AP, Western governments have often criticized Telegram for a lack of content moderation, which experts say opens up the messaging platform for potential use in money laundering, drug trafficking and the sharing of material linked to the sexual exploitation of minors.

In 2022, Germany issued fines of $5 million against Telegram’s operators for failing to establish a lawful way to reporting illegal content or to name an entity in Germany to receive official communication. Both are required under German laws that regulate large online platforms.

Last year, Brazil temporarily suspended Telegram over its failure to surrender data on neo-Nazi activity related to a police inquiry into school shootings in November.